3 ms·

> I guess it would be an interesting experiment to create a proxy that captures any values going out to gumroad's license verification api endpoint and change a

> I guess it would be an interesting experiment to create a proxy that captures any values going out to gumroad's license verification api endpoint and change all server responses to be true instead of false. Ditto for altering the number of uses of a product in case there is a limit there too. I built that proxy server years ago and created fake responses for multiple licensing APIs provided by companies like Paddle, Setapp, MacPaw, Devmate, MacRabbit, GitTower, Gumroad, OmniGroup, among several others. The proxy allowed me to use over 200 apps for free over the years. I tried to report this “vulnerability” (if we can call it that) to both Paddle and Setapp the same year I discovered them, but they never bothered to reply nor fix the problem. A couple of years ago, Paddle implemented a newer version of their API (v3) that uses SSL certificates and HTTP signatures to improve the security of their SDK, but I quickly found another way to bypass that protection. To this day, even though I can easily pay for all those software licenses, I keep the proxy running because it makes it easy to visualize outbound network traffic and block unwanted HTTP requests from all the apps I use. For example, how do you know that the setting to disable telemetry in that app you just installed actually disables telemetry? Even with a firewall like Little Snitch you can only allow/block domains/hostnames/ports but not individual API endpoints.

thih9 4y ago
Sounds interesting. Did you publish the source code? I have no idea how something like this would be built, especially in a way that it allows checking on telemetry; would be interesting to look at it.
- guessmyname 4y ago
  > Sounds interesting. Did you publish the source code? Thanks, but no, I did not. At the risk of sounding like a hypocrite, I do not want to enable other people to “steal” from these companies. These companies surely do not care if I use their apps for me, because I am just one person among several thousand potential customers. However, if I publish the code, many of these potential customers may stop purchasing their software licenses or subscriptions, and I do not want to be responsible for their loss in revenue. Also, I spent a lot of hours reverse engineering these apps and their corresponding APIs. I would not get anything out of publishing the code: it will not get me a better job, it will not get me clean money, it will not get me good publicity, it will do no good to anyone other than the people who want to use these apps for free without doing any work. --- > I have no idea how something like this would be built, especially in a way that it allows checking on telemetry; would be interesting to look at it. For the sake of learning, I will give you some hints: I originally used nginx, then I wrote my own Go program, and nowadays I use envoy proxy, but pretty much any proxy server will do the trick. Then, I created and installed my own Certificate Authority to automatically trust any self-signed certificate. Maybe you can use mkcert for that. That is the easy part. The difficult part(s), and the meat of the solution, is to reverse engineer every app to understand what and how it does things. I have used several disassemblers over the years but the one I like the most is Hopper Disassembler (https://www.hopperapp.com/ https://www.hopperapp.com/). You may find API keys, public SSL certificates, JSON field names, form field names, etc. and you simply need to put the pieces together to re-implement the API endpoint(s) that the app expects to use. Sometimes it is very easy, sometimes it is very difficult. You will learn a lot for sure.
  - ttoinou 4y ago
    It might force them build better APIs :)
  - jamil7 4y ago
    > At the risk of sounding like a hypocrite, I do not want to enable other people to “steal” from these companies. I can almost guarantee if you know about this others do too and will potentially sell or exploit it. I'd try reporting it again. Publishing it might ultimately get them to fix it, but is kind of the nuclear option.
    - roel_v 4y ago
      "Everybody" (i.e., everybody who thinks about this for 20 seconds) knows about this. Licensing is a matter of throwing up enough roadblocks to prevent the majority of users from easily bypassing your checks. There is no way to stop a determined attacker. That effort is likely better spend on developing new features. I wrote several 'licensing systems' over the years. It's a honey trap for developers - it's so easy to overthink it and spend months on 'hardening' your licensing, to the point where you have to check the generated assembly to see if your compiler doesn't do something clever where now all of a sudden 'cracking' your software turns into replacing a single JNZ instruction with a JMP. If you really 'need' protection against this, you use a 3rd party product which essentially converts your program into something that runs on their proprietary virtual machine. But if you do online license checking - how do you even 'fix' this? It's trivial to MITM all requests. So now you have to obfuscate your API calls, put in extra layers of crypto, hide your private keys for that will enough in your machine code, ... All of which will be cracked by someone halfway experienced in a matter of days. I think it's most likely the companies the GP reported this to just decided it's best to not bother until they have actual proof that this is a wide enough spread problem for them to make it worth putting in significant dev resources (because it does require significant resources).
  - bloqs 4y ago
    Thanks for the hints. Little jackpots like this are great learning motivation for some
  - 4y ago

thih9 4y ago

Sounds interesting. Did you publish the source code? I have no idea how something like this would be built, especially in a way that it allows checking on telemetry; would be interesting to look at it.

guessmyname 4y ago
> Sounds interesting. Did you publish the source code? Thanks, but no, I did not. At the risk of sounding like a hypocrite, I do not want to enable other people to “steal” from these companies. These companies surely do not care if I use their apps for me, because I am just one person among several thousand potential customers. However, if I publish the code, many of these potential customers may stop purchasing their software licenses or subscriptions, and I do not want to be responsible for their loss in revenue. Also, I spent a lot of hours reverse engineering these apps and their corresponding APIs. I would not get anything out of publishing the code: it will not get me a better job, it will not get me clean money, it will not get me good publicity, it will do no good to anyone other than the people who want to use these apps for free without doing any work. --- > I have no idea how something like this would be built, especially in a way that it allows checking on telemetry; would be interesting to look at it. For the sake of learning, I will give you some hints: I originally used nginx, then I wrote my own Go program, and nowadays I use envoy proxy, but pretty much any proxy server will do the trick. Then, I created and installed my own Certificate Authority to automatically trust any self-signed certificate. Maybe you can use mkcert for that. That is the easy part. The difficult part(s), and the meat of the solution, is to reverse engineer every app to understand what and how it does things. I have used several disassemblers over the years but the one I like the most is Hopper Disassembler (https://www.hopperapp.com/ https://www.hopperapp.com/). You may find API keys, public SSL certificates, JSON field names, form field names, etc. and you simply need to put the pieces together to re-implement the API endpoint(s) that the app expects to use. Sometimes it is very easy, sometimes it is very difficult. You will learn a lot for sure.
- ttoinou 4y ago
  It might force them build better APIs :)
- jamil7 4y ago
  > At the risk of sounding like a hypocrite, I do not want to enable other people to “steal” from these companies. I can almost guarantee if you know about this others do too and will potentially sell or exploit it. I'd try reporting it again. Publishing it might ultimately get them to fix it, but is kind of the nuclear option.
  - roel_v 4y ago
    "Everybody" (i.e., everybody who thinks about this for 20 seconds) knows about this. Licensing is a matter of throwing up enough roadblocks to prevent the majority of users from easily bypassing your checks. There is no way to stop a determined attacker. That effort is likely better spend on developing new features. I wrote several 'licensing systems' over the years. It's a honey trap for developers - it's so easy to overthink it and spend months on 'hardening' your licensing, to the point where you have to check the generated assembly to see if your compiler doesn't do something clever where now all of a sudden 'cracking' your software turns into replacing a single JNZ instruction with a JMP. If you really 'need' protection against this, you use a 3rd party product which essentially converts your program into something that runs on their proprietary virtual machine. But if you do online license checking - how do you even 'fix' this? It's trivial to MITM all requests. So now you have to obfuscate your API calls, put in extra layers of crypto, hide your private keys for that will enough in your machine code, ... All of which will be cracked by someone halfway experienced in a matter of days. I think it's most likely the companies the GP reported this to just decided it's best to not bother until they have actual proof that this is a wide enough spread problem for them to make it worth putting in significant dev resources (because it does require significant resources).
- bloqs 4y ago
  Thanks for the hints. Little jackpots like this are great learning motivation for some
- 4y ago